What is the CVSS score of CVE-2026-47019?

CVE-2026-47019 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Product Hub are affected by CVE-2026-47019?

Oracle Product Hub in E-Business Suite versions 12.2.3-12.2.15 contains a high-severity access control flaw allowing low-privileged users to read, modify, and delete product catalog data.

How to fix or mitigate CVE-2026-47019?

Within 24 hours, identify all systems running Oracle E-Business Suite versions 12.2.3 through 12.2.15 and confirm current patch levels. Within 7 days, apply the July 2026 Critical Patch Update to all affected instances; if immediate patching is constrained, restrict Product Hub HTTP access to authenticated administrative users and implement network segmentation. Complete patching of all affected systems within 30 days.

Oracle Product Hub CVE-2026-47019

EUVD-2026-46508 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-pwqx-3wf6-xcjg

Authentication Bypass Oracle Oracle Product Hub Oracle Corporation

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reachability with a low-privilege account and no user interaction gives AV:N/AC:L/PR:L/UI:N; full read/write over module data yields C:H/I:H, with no availability impact so A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:24 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Product Hub accessible data as well as unauthorized access to critical data or complete access to all Oracle Product Hub accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Product Hub (Oracle E-Business Suite Item Catalog component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, delete, or modify all Product Hub-accessible data. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impact with no availability effect. No public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle E-Business Suite flaws are attractive targets and this issue is fixed in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle Product Hub is the master-data / product information management (PIM) module of Oracle E-Business Suite, and the affected surface is its Item Catalog component, which manages item definitions, categories, and attributes. The vulnerability is exposed over the EBS web tier via HTTP, meaning it is reachable through the standard Oracle Application Server / OA Framework front end that fronts the underlying database. Oracle did not assign a CWE (CWE: N/A), but the CVSS profile (authenticated attacker gaining full read and write over all module-accessible data with no availability loss) combined with the vendor 'Authentication Bypass' tag is consistent with a broken access-control / authorization-flaw class where a low-privilege session can reach data and operations beyond its intended scope. The single affected CPE is cpe:2.3:a:oracle_corporation:oracle_product_hub:*, spanning the 12.2.x code line.

RemediationAI

Apply the fix from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle delivers EBS 12.2 fixes as CPU patches layered on the applicable 12.2.x codelevel rather than as a single named version, so identify and apply the CPU patch that corresponds to your installed release between 12.2.3 and 12.2.15. Because exploitation requires network HTTP access with low privileges, compensating controls until patching include restricting EBS web-tier exposure to trusted networks/VPN and placing it behind a WAF or reverse proxy, tightening Product Hub / Item Catalog role and responsibility assignments to limit which authenticated users can reach the component, and increasing audit logging on catalog data changes to detect unauthorized create/delete/modify activity - noting that access restrictions may inconvenience legitimate remote users and are only a stopgap, not a substitute for the CPU patch.